@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/plugins/siwe/client.mjs

@@ -0,0 +1,15 @@
+import { PACKAGE_VERSION } from "../../version.mjs";
+//#region src/plugins/siwe/client.ts
+const siweClient = () => {
+	return {
+		id: "siwe",
+		version: PACKAGE_VERSION,
+		$InferServerPlugin: {},
+		pathMethods: {
+			"/siwe/nonce": "POST",
+			"/siwe/get-nonce": "POST"
+		}
+	};
+};
+//#endregion
+export { siweClient };

package/dist/plugins/siwe/index.d.mts

@@ -0,0 +1,62 @@
+import { InferOptionSchema } from "../../types/plugins.mjs";
+import { WalletAddressSchema, schema } from "./schema.mjs";
+import { ENSLookupArgs, ENSLookupResult, SIWEVerifyMessageArgs } from "./types.mjs";
+import * as _$better_call0 from "better-call";
+import * as z from "zod";
+
+//#region src/plugins/siwe/index.d.ts
+declare module "@better-auth/core" {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    siwe: {
+      creator: typeof siwe;
+    };
+  }
+}
+interface SIWEPluginOptions {
+  domain: string;
+  emailDomainName?: string | undefined;
+  anonymous?: boolean | undefined;
+  getNonce: () => Promise<string>;
+  verifyMessage: (args: SIWEVerifyMessageArgs) => Promise<boolean>;
+  ensLookup?: ((args: ENSLookupArgs) => Promise<ENSLookupResult>) | undefined;
+  schema?: InferOptionSchema<typeof schema> | undefined;
+}
+declare const siwe: (options: SIWEPluginOptions) => {
+  id: "siwe";
+  version: string;
+  schema: WalletAddressSchema;
+  endpoints: {
+    getSiweNonce: _$better_call0.StrictEndpoint<"/siwe/nonce" | "/siwe/get-nonce", {
+      method: "POST";
+      body: z.ZodOptional<z.ZodObject<{}, z.core.$strict>>;
+    }, {
+      nonce: string;
+    }>;
+    getNonce: _$better_call0.StrictEndpoint<"/siwe/nonce" | "/siwe/get-nonce", {
+      method: "POST";
+      body: z.ZodOptional<z.ZodObject<{}, z.core.$strict>>;
+    }, {
+      nonce: string;
+    }>;
+    verifySiweMessage: _$better_call0.StrictEndpoint<"/siwe/verify", {
+      method: "POST";
+      body: z.ZodObject<{
+        message: z.ZodString;
+        signature: z.ZodString;
+        email: z.ZodOptional<z.ZodEmail>;
+      }, z.core.$strict>;
+      requireRequest: true;
+    }, {
+      token: string;
+      success: boolean;
+      user: {
+        id: string;
+        walletAddress: string;
+        chainId: number;
+      };
+    }>;
+  };
+  options: SIWEPluginOptions;
+};
+//#endregion
+export { SIWEPluginOptions, siwe };

package/dist/plugins/siwe/index.mjs

@@ -0,0 +1,272 @@
+import { isAPIError } from "../../utils/is-api-error.mjs";
+import { mergeSchema } from "../../db/schema.mjs";
+import { setSessionCookie } from "../../cookies/index.mjs";
+import { APIError } from "../../api/index.mjs";
+import { PACKAGE_VERSION } from "../../version.mjs";
+import { toChecksumAddress } from "../../utils/hashing.mjs";
+import { normalizeSiweDomain, parseSiweMessage } from "./parse-message.mjs";
+import { schema } from "./schema.mjs";
+import { createAuthEndpoint } from "@better-auth/core/api";
+import * as z from "zod";
+import { createPlaceholderEmail } from "@better-auth/core/utils/email";
+//#region src/plugins/siwe/index.ts
+const signedWalletAddressSchema = z.string().regex(/^0x[a-fA-F0-9]{40}$/).length(42);
+const SIWE_VERIFICATION_IDENTIFIER_PREFIX = "siwe:";
+const SIWE_NONCE_MAX_LENGTH = 250;
+const SIWE_NONCE_ALPHANUMERIC_REGEX = /^[a-zA-Z0-9]+$/;
+const isValidSiweNonce = (nonce) => typeof nonce === "string" && nonce.length >= 8 && nonce.length <= SIWE_NONCE_MAX_LENGTH && SIWE_NONCE_ALPHANUMERIC_REGEX.test(nonce);
+const getSiweNonceBodySchema = z.object({}).strict().optional();
+const siwe = (options) => {
+	const createSiweNonceEndpoint = (path) => createAuthEndpoint(path, {
+		method: "POST",
+		body: getSiweNonceBodySchema
+	}, async (ctx) => {
+		const nonce = await options.getNonce();
+		if (!isValidSiweNonce(nonce)) throw APIError.fromStatus("INTERNAL_SERVER_ERROR", {
+			message: `SIWE getNonce must return an ERC-4361 nonce: 8-${SIWE_NONCE_MAX_LENGTH} alphanumeric characters.`,
+			status: 500,
+			code: "SIWE_INVALID_NONCE"
+		});
+		await ctx.context.internalAdapter.createVerificationValue({
+			identifier: `${SIWE_VERIFICATION_IDENTIFIER_PREFIX}${nonce}`,
+			value: nonce,
+			expiresAt: new Date(Date.now() + 900 * 1e3)
+		});
+		return ctx.json({ nonce });
+	});
+	return {
+		id: "siwe",
+		version: PACKAGE_VERSION,
+		schema: mergeSchema(schema, options?.schema),
+		endpoints: {
+			getSiweNonce: createSiweNonceEndpoint("/siwe/nonce"),
+			getNonce: createSiweNonceEndpoint("/siwe/get-nonce"),
+			verifySiweMessage: createAuthEndpoint("/siwe/verify", {
+				method: "POST",
+				body: z.object({
+					message: z.string().min(1),
+					signature: z.string().min(1),
+					email: z.email().optional()
+				}).strict().refine((data) => options.anonymous !== false || !!data.email, {
+					message: "Email is required when the anonymous plugin option is disabled.",
+					path: ["email"]
+				}),
+				requireRequest: true
+			}, async (ctx) => {
+				const { message, signature, email } = ctx.body;
+				const isAnon = options.anonymous ?? true;
+				if (!isAnon && !email) throw APIError.fromStatus("BAD_REQUEST", {
+					message: "Email is required when anonymous is disabled.",
+					status: 400
+				});
+				try {
+					const parsedMessage = parseSiweMessage(message);
+					if (!isValidSiweNonce(parsedMessage.nonce)) throw APIError.fromStatus("UNAUTHORIZED", {
+						message: "Unauthorized: SIWE message does not match the expected nonce, domain, address, or chain ID",
+						status: 401,
+						code: "UNAUTHORIZED_SIWE_MESSAGE_MISMATCH"
+					});
+					if (!await ctx.context.internalAdapter.consumeVerificationValue(`${SIWE_VERIFICATION_IDENTIFIER_PREFIX}${parsedMessage.nonce}`)) throw APIError.fromStatus("UNAUTHORIZED", {
+						message: "Unauthorized: Invalid or expired nonce",
+						status: 401,
+						code: "UNAUTHORIZED_INVALID_OR_EXPIRED_NONCE"
+					});
+					const nonce = parsedMessage.nonce;
+					const parsedWalletAddress = signedWalletAddressSchema.safeParse(parsedMessage.address);
+					const walletAddress = parsedWalletAddress.success ? toChecksumAddress(parsedWalletAddress.data) : null;
+					const chainId = parsedMessage.chainId;
+					const domainMatches = !!parsedMessage.domain && normalizeSiweDomain(parsedMessage.domain) === normalizeSiweDomain(options.domain);
+					if (!walletAddress || typeof chainId !== "number" || chainId <= 0 || !domainMatches) throw APIError.fromStatus("UNAUTHORIZED", {
+						message: "Unauthorized: SIWE message does not match the expected nonce, domain, address, or chain ID",
+						status: 401,
+						code: "UNAUTHORIZED_SIWE_MESSAGE_MISMATCH"
+					});
+					const now = Date.now();
+					if (parsedMessage.expirationTime) {
+						const expiresAt = Date.parse(parsedMessage.expirationTime);
+						if (!Number.isNaN(expiresAt) && now >= expiresAt) throw APIError.fromStatus("UNAUTHORIZED", {
+							message: "Unauthorized: SIWE message has expired",
+							status: 401,
+							code: "UNAUTHORIZED_SIWE_MESSAGE_EXPIRED"
+						});
+					}
+					if (parsedMessage.notBefore) {
+						const notBefore = Date.parse(parsedMessage.notBefore);
+						if (!Number.isNaN(notBefore) && now < notBefore) throw APIError.fromStatus("UNAUTHORIZED", {
+							message: "Unauthorized: SIWE message is not yet valid",
+							status: 401,
+							code: "UNAUTHORIZED_SIWE_MESSAGE_NOT_YET_VALID"
+						});
+					}
+					if (!await options.verifyMessage({
+						message,
+						signature,
+						address: walletAddress,
+						chainId,
+						cacao: {
+							h: { t: "caip122" },
+							p: {
+								domain: options.domain,
+								aud: options.domain,
+								nonce,
+								iss: options.domain,
+								version: "1"
+							},
+							s: {
+								t: "eip191",
+								s: signature
+							}
+						}
+					})) throw APIError.fromStatus("UNAUTHORIZED", {
+						message: "Unauthorized: Invalid SIWE signature",
+						status: 401
+					});
+					let user = null;
+					const existingWalletAddress = await ctx.context.adapter.findOne({
+						model: "walletAddress",
+						where: [{
+							field: "address",
+							operator: "eq",
+							value: walletAddress
+						}, {
+							field: "chainId",
+							operator: "eq",
+							value: chainId
+						}]
+					});
+					if (existingWalletAddress) user = await ctx.context.adapter.findOne({
+						model: "user",
+						where: [{
+							field: "id",
+							operator: "eq",
+							value: existingWalletAddress.userId
+						}]
+					});
+					else {
+						const anyWalletAddress = await ctx.context.adapter.findOne({
+							model: "walletAddress",
+							where: [{
+								field: "address",
+								operator: "eq",
+								value: walletAddress
+							}]
+						});
+						if (anyWalletAddress) user = await ctx.context.adapter.findOne({
+							model: "user",
+							where: [{
+								field: "id",
+								operator: "eq",
+								value: anyWalletAddress.userId
+							}]
+						});
+					}
+					if (!user) {
+						const normalizedEmail = email?.toLowerCase();
+						const walletEmail = options.emailDomainName ? `${walletAddress}@${options.emailDomainName}` : createPlaceholderEmail({
+							identifier: walletAddress,
+							namespace: "siwe"
+						});
+						let userEmail = walletEmail;
+						let emailClaimIdentifier;
+						if (!isAnon && normalizedEmail) {
+							const identifier = `siwe-email-claim-${normalizedEmail}`;
+							let reserved = false;
+							try {
+								reserved = await ctx.context.internalAdapter.reserveVerificationValue({
+									identifier,
+									value: walletAddress,
+									expiresAt: new Date(Date.now() + 6e4)
+								});
+							} catch {
+								reserved = false;
+							}
+							if (reserved) {
+								emailClaimIdentifier = identifier;
+								if (!await ctx.context.internalAdapter.findUserByEmail(normalizedEmail)) userEmail = normalizedEmail;
+							}
+						}
+						const { name, avatar } = await options.ensLookup?.({ walletAddress }) ?? {};
+						const createSIWEUser = (email) => ctx.context.internalAdapter.createUser({
+							name: name ?? walletAddress,
+							email,
+							image: avatar ?? ""
+						}, { method: "siwe" });
+						try {
+							user = await createSIWEUser(userEmail);
+						} catch (error) {
+							if (userEmail !== normalizedEmail || !normalizedEmail) throw error;
+							if (!await ctx.context.internalAdapter.findUserByEmail(normalizedEmail)) throw error;
+							userEmail = walletEmail;
+							user = await createSIWEUser(userEmail);
+						} finally {
+							if (emailClaimIdentifier) await ctx.context.internalAdapter.consumeVerificationValue(emailClaimIdentifier).catch(() => {});
+						}
+						await ctx.context.adapter.create({
+							model: "walletAddress",
+							data: {
+								userId: user.id,
+								address: walletAddress,
+								chainId,
+								isPrimary: true,
+								createdAt: /* @__PURE__ */ new Date()
+							}
+						});
+						await ctx.context.internalAdapter.createAccount({
+							userId: user.id,
+							providerId: "siwe",
+							accountId: `${walletAddress}:${chainId}`,
+							createdAt: /* @__PURE__ */ new Date(),
+							updatedAt: /* @__PURE__ */ new Date()
+						});
+					} else if (!existingWalletAddress) {
+						await ctx.context.adapter.create({
+							model: "walletAddress",
+							data: {
+								userId: user.id,
+								address: walletAddress,
+								chainId,
+								isPrimary: false,
+								createdAt: /* @__PURE__ */ new Date()
+							}
+						});
+						await ctx.context.internalAdapter.createAccount({
+							userId: user.id,
+							providerId: "siwe",
+							accountId: `${walletAddress}:${chainId}`,
+							createdAt: /* @__PURE__ */ new Date(),
+							updatedAt: /* @__PURE__ */ new Date()
+						});
+					}
+					const session = await ctx.context.internalAdapter.createSession(user.id);
+					if (!session) throw APIError.fromStatus("INTERNAL_SERVER_ERROR", {
+						message: "Internal Server Error",
+						status: 500
+					});
+					await setSessionCookie(ctx, {
+						session,
+						user
+					});
+					return ctx.json({
+						token: session.token,
+						success: true,
+						user: {
+							id: user.id,
+							walletAddress,
+							chainId
+						}
+					});
+				} catch (error) {
+					if (isAPIError(error)) throw error;
+					throw APIError.fromStatus("UNAUTHORIZED", {
+						message: "Something went wrong. Please try again later.",
+						error: error instanceof Error ? error.message : "Unknown error",
+						status: 401
+					});
+				}
+			})
+		},
+		options
+	};
+};
+//#endregion
+export { siwe };

package/dist/plugins/siwe/parse-message.mjs

@@ -0,0 +1,60 @@
+//#region src/plugins/siwe/parse-message.ts
+const HEADER_REGEX = /^(?:([a-zA-Z][a-zA-Z0-9+.-]*):\/\/)?(\S+) wants you to sign in with your Ethereum account:$/;
+const ADDRESS_REGEX = /^0x[a-fA-F0-9]{40}$/;
+const FIELD_REGEX = /^([A-Za-z ]+): (.*)$/;
+function parseSiweMessage(message) {
+	const result = {};
+	const lines = message.split(/\r?\n/);
+	const headerMatch = lines[0]?.match(HEADER_REGEX);
+	if (headerMatch) {
+		if (headerMatch[1]) result.scheme = headerMatch[1];
+		result.domain = headerMatch[2];
+	}
+	const addressLine = lines[1]?.trim();
+	if (addressLine && ADDRESS_REGEX.test(addressLine)) result.address = addressLine;
+	for (const line of lines) {
+		const match = line.match(FIELD_REGEX);
+		if (!match) continue;
+		const [, key, value] = match;
+		switch (key) {
+			case "URI":
+				result.uri = value;
+				break;
+			case "Version":
+				result.version = value;
+				break;
+			case "Chain ID": {
+				const parsed = Number(value);
+				if (Number.isInteger(parsed)) result.chainId = parsed;
+				break;
+			}
+			case "Nonce":
+				result.nonce = value;
+				break;
+			case "Issued At":
+				result.issuedAt = value;
+				break;
+			case "Expiration Time":
+				result.expirationTime = value;
+				break;
+			case "Not Before":
+				result.notBefore = value;
+				break;
+			case "Request ID":
+				result.requestId = value;
+				break;
+		}
+	}
+	return result;
+}
+/**
+* Normalizes a SIWE `domain` (RFC 3986 authority) for comparison: strips any
+* scheme and path, lowercases, leaving `host[:port]`.
+*/
+function normalizeSiweDomain(domain) {
+	const withoutScheme = domain.trim().toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, "");
+	const pathStart = withoutScheme.indexOf("/");
+	return pathStart === -1 ? withoutScheme : withoutScheme.slice(0, pathStart);
+}
+//#endregion
+export { normalizeSiweDomain, parseSiweMessage };

package/dist/plugins/siwe/schema.d.mts

@@ -0,0 +1,35 @@
+//#region src/plugins/siwe/schema.d.ts
+declare const schema: {
+  walletAddress: {
+    fields: {
+      userId: {
+        type: "string";
+        references: {
+          model: string;
+          field: string;
+        };
+        required: true;
+        index: true;
+      };
+      address: {
+        type: "string";
+        required: true;
+      };
+      chainId: {
+        type: "number";
+        required: true;
+      };
+      isPrimary: {
+        type: "boolean";
+        defaultValue: false;
+      };
+      createdAt: {
+        type: "date";
+        required: true;
+      };
+    };
+  };
+};
+type WalletAddressSchema = typeof schema;
+//#endregion
+export { WalletAddressSchema, schema };

package/dist/plugins/siwe/schema.mjs

@@ -0,0 +1,30 @@
+//#region src/plugins/siwe/schema.ts
+const schema = { walletAddress: { fields: {
+	userId: {
+		type: "string",
+		references: {
+			model: "user",
+			field: "id"
+		},
+		required: true,
+		index: true
+	},
+	address: {
+		type: "string",
+		required: true
+	},
+	chainId: {
+		type: "number",
+		required: true
+	},
+	isPrimary: {
+		type: "boolean",
+		defaultValue: false
+	},
+	createdAt: {
+		type: "date",
+		required: true
+	}
+} } };
+//#endregion
+export { schema };

package/dist/plugins/siwe/types.d.mts

@@ -0,0 +1,43 @@
+//#region src/plugins/siwe/types.d.ts
+interface CacaoHeader {
+  t: "caip122";
+}
+interface CacaoPayload {
+  domain: string;
+  aud: string;
+  nonce: string;
+  iss: string;
+  version?: string | undefined;
+  iat?: string | undefined;
+  nbf?: string | undefined;
+  exp?: string | undefined;
+  statement?: string | undefined;
+  requestId?: string | undefined;
+  resources?: string[] | undefined;
+  type?: string | undefined;
+}
+interface Cacao {
+  h: CacaoHeader;
+  p: CacaoPayload;
+  s: {
+    t: "eip191" | "eip1271";
+    s: string;
+    m?: string | undefined;
+  };
+}
+interface SIWEVerifyMessageArgs {
+  message: string;
+  signature: string;
+  address: string;
+  chainId: number;
+  cacao?: Cacao | undefined;
+}
+interface ENSLookupArgs {
+  walletAddress: string;
+}
+interface ENSLookupResult {
+  name: string;
+  avatar: string;
+}
+//#endregion
+export { ENSLookupArgs, ENSLookupResult, SIWEVerifyMessageArgs };

package/dist/plugins/test-utils/auth-helpers.mjs

@@ -0,0 +1,33 @@
+import { createCookieHeaders, createTestCookie } from "./cookie-builder.mjs";
+import { sessionSchema } from "@better-auth/core/db";
+//#region src/plugins/test-utils/auth-helpers.ts
+function createSession(ctx, opts) {
+	const additionalFields = Object.fromEntries(Object.entries(opts.session ?? {}).filter(([key]) => !Object.hasOwn(sessionSchema.shape, key)));
+	return ctx.internalAdapter.createSession(opts.userId, false, additionalFields, true);
+}
+function createLogin(ctx) {
+	return async (opts) => {
+		const user = await ctx.internalAdapter.findUserById(opts.userId);
+		if (!user) throw new Error(`User not found: ${opts.userId}`);
+		const session = await createSession(ctx, opts);
+		return {
+			session,
+			user,
+			headers: await createCookieHeaders(ctx, session.token),
+			cookies: await createTestCookie(ctx, session.token),
+			token: session.token
+		};
+	};
+}
+function createGetAuthHeaders(ctx) {
+	return async (opts) => {
+		return createCookieHeaders(ctx, (await createSession(ctx, opts)).token);
+	};
+}
+function createGetCookies(ctx) {
+	return async (opts) => {
+		return createTestCookie(ctx, (await createSession(ctx, opts)).token, opts.domain);
+	};
+}
+//#endregion
+export { createGetAuthHeaders, createGetCookies, createLogin };

package/dist/plugins/test-utils/cookie-builder.mjs

@@ -0,0 +1,55 @@
+import { makeSignature } from "../../crypto/index.mjs";
+//#region src/plugins/test-utils/cookie-builder.ts
+/**
+* Signs a cookie value using HMAC-SHA256
+*/
+async function signCookieValue(value, secret) {
+	return `${value}.${await makeSignature(value, secret)}`;
+}
+/**
+* Creates a test cookie with proper signing and attributes
+*/
+async function createTestCookie(ctx, sessionToken, domain) {
+	const secret = ctx.secret;
+	const signedToken = await signCookieValue(sessionToken, secret);
+	const cookieName = ctx.authCookies.sessionToken.name;
+	const cookieAttrs = ctx.authCookies.sessionToken.attributes;
+	return [{
+		name: cookieName,
+		value: signedToken,
+		domain: domain || getDomainFromBaseURL(ctx.baseURL),
+		path: cookieAttrs.path || "/",
+		httpOnly: cookieAttrs.httpOnly ?? true,
+		secure: cookieAttrs.secure ?? false,
+		sameSite: normalizeSameSite(cookieAttrs.sameSite),
+		expires: cookieAttrs.maxAge ? Math.floor(Date.now() / 1e3) + cookieAttrs.maxAge : void 0
+	}];
+}
+/**
+* Creates a Headers object with the cookie header set
+*/
+async function createCookieHeaders(ctx, sessionToken) {
+	const secret = ctx.secret;
+	const signedToken = await signCookieValue(sessionToken, secret);
+	const cookieName = ctx.authCookies.sessionToken.name;
+	const headers = new Headers();
+	headers.set("cookie", `${cookieName}=${signedToken}`);
+	return headers;
+}
+function getDomainFromBaseURL(baseURL) {
+	try {
+		return new URL(baseURL).hostname;
+	} catch {
+		return "localhost";
+	}
+}
+function normalizeSameSite(sameSite) {
+	if (typeof sameSite === "string") {
+		const lower = sameSite.toLowerCase();
+		if (lower === "strict") return "Strict";
+		if (lower === "none") return "None";
+	}
+	return "Lax";
+}
+//#endregion
+export { createCookieHeaders, createTestCookie };

package/dist/plugins/test-utils/db-helpers.mjs

@@ -0,0 +1,65 @@
+import { generateRandomString } from "../../crypto/random.mjs";
+//#region src/plugins/test-utils/db-helpers.ts
+function createSaveUser(ctx) {
+	return async (user) => {
+		return ctx.internalAdapter.createUser(user, { method: "test" });
+	};
+}
+function createDeleteUser(ctx) {
+	return async (userId) => {
+		await ctx.internalAdapter.deleteUser(userId);
+	};
+}
+function createSaveOrganization(ctx) {
+	return async (org) => {
+		return await ctx.adapter.create({
+			model: "organization",
+			data: org,
+			forceAllowId: true
+		});
+	};
+}
+function createDeleteOrganization(ctx) {
+	return async (orgId) => {
+		await ctx.adapter.deleteMany({
+			model: "member",
+			where: [{
+				field: "organizationId",
+				value: orgId
+			}]
+		});
+		await ctx.adapter.deleteMany({
+			model: "invitation",
+			where: [{
+				field: "organizationId",
+				value: orgId
+			}]
+		});
+		await ctx.adapter.delete({
+			model: "organization",
+			where: [{
+				field: "id",
+				value: orgId
+			}]
+		});
+	};
+}
+function createAddMember(ctx) {
+	return async (opts) => {
+		const generatedId = ctx.generateId({ model: "member" });
+		const id = generatedId === false ? generateRandomString(24, "a-z", "A-Z", "0-9") : generatedId;
+		return await ctx.adapter.create({
+			model: "member",
+			data: {
+				id,
+				userId: opts.userId,
+				organizationId: opts.organizationId,
+				role: opts.role || "member",
+				createdAt: /* @__PURE__ */ new Date()
+			},
+			forceAllowId: true
+		});
+	};
+}
+//#endregion
+export { createAddMember, createDeleteOrganization, createDeleteUser, createSaveOrganization, createSaveUser };